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In this paper we analyze the security of the so-called quantum tomographic cryptography with 
the source producing entangled photons via an experimental scheme proposed in Phys. Rev. Lett. 
92, 37903 (2004). We determine the range of the experimental parameters for which the protocol 
is secure against the most general incoherent attacks. 
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INTRODUCTION 

The need to transmit information securely between two 
parties is off paramount importance in military and com- 
mercial communication. The discovery of the possibility 
of secure communication based on photons has triggered 
numerous investigations in this field. An important issue 
in quantum communication is the ability to distribute 
a key securely between distantparties, and a number 
of schemes such as the BB84 [l| and Ekert91 |2( have 
been proposed for this purpose. In particular, the to- 
mographic quantum key distribution scheme proposed in 
Ref. P| in which Alice and Bob utilize a tomographically 
complete set of observables to distribute the key as well 
as perform full state tomography on their key distribu- 
tion source has been shown to be powerful as it severely 
limits Eve's eavesdropping possibilities, when compared 
to BB84 or Ekcrt91. An extension of this scheme to the 
more general class of Bell diagonal states has also been 
proposed in Ref. Q- 

On the practical side, quantum key distribution 
(QKD) is a sufficiently advanced field so that there is 
already the possibility for commercialization of some of 
the QKD devices. However, security analysis of generic 
devices is not always straightforward. 

Recently, using the pulsed optical excitation of a sin- 
gle quantum dot from a sample of self-assembled InAs 
quantum dots in a GaAs matrix, it was shown that it 
is possible to use linear optics techniques to induce po- 
larization entanglement between single photons emitted 
independently from the source 0, 0, ■ Such a technique 
can be feasibly applied to produce entangled photons for 
QKD. In this letter, we exploit the tomographic QKD 
scheme to study the security of QKD based on such 
solid state devices. 



TOMOGRAPHIC QKD 

In the tomographic QKD scheme a central source 
distributes entangled qubits to Alice and Bob. Here, 
we assume that these qubits arise from polarization- 
entangled photons generated using a quantum dot sin- 



gle photon source and the method described by Fattal 
et al. Alice and Bob independently and randomly 
choose to measure three tomographically complete ob- 
servables cr x , <Ty and a z (Pauli operators) on each qubit. 
At the end of the transmission, they publicly announce 
their choice of observables for each qubit pair. They 
then divide their measurement results according to those 
for which their measurement bases match, and those for 
which their measurement bases do not match. Exchang- 
ing a subset of their measurements allows Alice and Bob 
to tomographically reconstruct the density operator of 
the two-qubit state they share. Those measurements for 
which their bases match can be used for key generation. 

According to the discussion presented in Ref. the 
density matrix describing the photon source has the fol- 
lowing form in the (say) a z basis: 
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The meaning of the experimentally accessible parameters 
R, T, V and g is the following: R(T) denotes the reflec- 
tivity (transmittivity) of the beamsplitters in the Mach- 
Zehnder interferometer used in the experiment (the ratio 
Y reported in Ref. |5j was 1.1). The parameter V de- 
notes the overlap of the wave packets of two consecutive 
photons emerging from the quantum dot, and g (denoted 
in Ref. [3 as g^) is the equal time second-order correla- 
tion function. Furthermore, in order for entanglement to 
exist in the two photon state, we require that V > 2g. 
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From the point of view of the security analysis, 
it is more convenient to express the density matrix 
in the Bell basis {|m a6 )} O)6=0 ,i. Here, \m ab ) = 
J2k=o ~7f ti;feb | TO fc»^fc+a) = —1) denotes the Bell state 
in the mth basis (m = x, y, z). We have 
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and in the remaining two other bases 
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From their state tomography, Alice and Bob can deter- 
mine how the parameters ^ , g and V affect the security of 
their key. From these parameters, they can compute, for 
each basis, the maximal strength of correlations between 
Eve and any one of them. The Csiszar-Koner (CK) the- 
orem then guarantees that if the correlations between 
Alice and Bob are stronger than those between Eve and 
either of them, a secure key can be established through 
one-way error correcting codes, with the efficiency given 
by the CK yield. Thus for each basis, there is a CK yield 
for Alice and Bob's bit data, and they can find out which 
basis will give them a positive CK yield. They will then 
make use of data only from those bases with a positive 
yield to establish their key, rejecting the bits obtained 
from the remaining measurements. It is interesting to 
note that in the tomographic protocol presented in Q, 
Alice and Bob do not have to do this as the yield is the 
same regardless of the measurement basis. 



EAVESDROPPING 

Suppose we have an eavesdropper Eve in the chan- 
nel. In order to make our analysis foolproof, we assume 
the worst-case scenario in which she is in full control 
of the qubit-distributing source, and that all the factors 
that contribute to experimental imperfections (parame- 
ters R, T, g and V) are due to her eavesdropping activi- 
ties. 

In order to obtain as much information as possible 
about the key generated by Alice and Bob, Eve entangles 

( z} 

their qubits with ancilla states \e ab ) in her possession. 
She prepares the following state: 
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Tracing out Eve gives the mixed state Eq. © that Al- 
ice and Bob measure and this purification is the most 
general one as far as eavesdropping is concerned. Note 
that because of the tomography performed by Alice and 
Bob, Eve cannot prepare a state that would give her some 
additional correlations across different qubits emitted by 
the source. This considerably reduces the number of co- 
herent eavesdropping strategies Eve can use. More pre- 
cisely, the only possibility of a coherent attack for Eve is 
to collect her ancillas and perform some collective mea- 
surements on them. In this paper we do not investigate 
this scenario and assume that Eve measures her ancillas 
one by one. 

Eve's purification, when expressed in different bases, 
reads 



ABE I 



]C \M^\ Z k,Z k+a )\fak) 
-,a=0 

1 

V ^ak\y^Vk+a)\fl k ) 



k,a=0 
1 



V Vak\ X k,Xk+a)\fa k 



(7) 



fc,a=0 



where 



(z) 



t^ak ~ ^ak 



= S a . a + 5 a ,l I (5fe,o - 4,l)7 + 

a + Pi a + (3 2 

= o a ,o — 7, \~ o a ,i- 



fa. + Pi 



2 2 
The ancilla kets have the following inner products 

5kk', ifa = a' = 0, 



(8) 



ifa'k' I /ok) 
(fa'k' l/afc) 



<w + (i-<W) . 2 , 

if a = a' = 1, 

0, if a ^ a'. 

(fa'k'lfak) 

' S k k' + (1-Skk')^, ifo = o' = 0; 
Skk' + (1 - <W)fq-^-. ifa = a' = l; 



V(a+/3l)(a+/3 2 ) 



uj k+k ' , if a 7^ a' 



(9) 



Eve's eavesdropping strategy then proceeds as follows. 
After Alice and Bob announce their measurement bases 
and the basis they intend to use for key generation, Eve 
knows which pairs of qubits contribute to the key and 
that her ancilla for each of those pairs is a mixture of 
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four possible states. Formally this can be viewed as a 
transmission of information from Alice and Bob to Eve 
encoded in the quantum state of Eve's ancilla. To find the 
optimal eavesdropping strategy, she has to maximize this 
information transfer by a choice of a suitable generalized 
measurement known as a Positive Operator Valued Mea- 
sure (POVM) ;SJ. For example, if Alice and Bob chose 
to obtain their key from the x basis, Eve would obtain 
the following mixed state of ancillas, 

QP = £ ^\fak)(fa k \- (10) 
fc,a=0 

Eve has to find the optimal measurement that will extract 
from the transmission as much information as possible, 
the so-called accessible information. 

INCOHERENT ATTACK 

The conditions for which our protocol is secure against 
Eve's incoherent eavesdropping attack is given by the CK 
theorem: a secure key can be generated from a raw key 
sequence by means of a suitably chosen error-correcting 
code and classical one-way communication between Alice 
and Bob if the mutual information between Alice and 
Bob (T(A;B)) exceeds that between Eve and either one 
of them (the CK regime). For the protocol considered, 
the mutual information between Alice and Eve (I (A; E)), 
and Bob and Eve, are the same so that security is assured 
as long as 

I{A;B) > I{A;E). (11) 

Furthermore, the difference in mutual information 
1(A; B) - 1(A; E) gives the CK yield for the distilled 
key. Due to the asymmetric nature of the state in the 
cr 2 and o x jo y bases, the yield is different for those bases. 
The yield is the same for a x and o~ y . As mentioned ear- 
lier, Alice and Bob will choose only those measurement 
bases which give them a positive yield and use the data 
from those bases for key generation. 

We shall now present the POVM that maximizes the 
information transmitted from Alice and Bob to Eve for 
a given basis. 

Suppose Eve receives a state in the a z basis: 

& = £ /4to</aU (12) 

where the kets have the structure given by Eq. An- 
cillas from the correlation subspace (a = 0) are orthog- 
onal to all other states; those from the anti-correlation 
subspace (a — 1) are in general non-orthogonal among 
themselves. 

In the first step, Eve sorts the mixture of the ancillas 
into two sub-ensembles according to the index a. This 



can easily be done using a projective measurement. After 
that, depending on the outcome of the projection (a = 
or a = 1), Eve has a mixture of two ancilla states each 
corresponding to Alice and Bob's result. 

If she projects into the a = subspace, Eve will possess 
a mixture of equiprobablc orthogonal ancilla states 

eL'Uo = |l/ob></ool + |]/oi></oiU (13) 

which she can distinguish perfectly. 

On the other hand, if she projects into the a = 1 sub- 
space, she will obtain a mixture of non-orthogonal ancilla 
states instead: 

e£-i = (2 + 2a + ft + ft) l / i">< / i"ol 

+ (l-^rhih) lf;M " 1 (14) 

We shall denote the inner product of the two ancilla 
states by A e . P 1 ~P 2 jf these states arc 

V / (/3i+/32) 2 - 4 7 2 

equiprobable, which happens if 7 = or R = T, the 
optimal measurement for Eve would be the so-called 
square-root measurement |lOl lll| . Its POVM is given 
by {|ci>o)(wo|, where 

kio) = (-Vvlfw) + v/i - vlfix)) 

kn> = (yi^l/fo) - Vv\fn)) , 

(15) 

with r\ = |(1 + \/l — A 2 ) being the probability of deter- 
mining a given state correctly. 

In general, the ancilla states will not occur with the 
same probability, and the optimal measurement for Eve 
will then not be the square-root measurement. Consider 
the POVM {|£io)(a>io|, \w n )(G)u\}, where 

pio) = cos^l^io) — sin^l^n) 

\u>u) = sin 6\lu w ) + cos 9\ujii}. (16) 

These states are rotated from the square-root measure- 
ment states by an angle 9. We then have the following 
conditional probabilities 



P(^io|/i 2 o) = [Vv cos 9 - y/l - 77 sin 6) 

P (£11 1/10) = (Vv sin 6 + V 1 - V cos °) 

PO^iol/u) = (Vl - 7? cos 6< - V^sinfi 1 ) 

P&nlfn) = (VT^V] sm 9 + cos 9^ 2 , (17) 

where, for instance, p{&\i\f*\) denotes the probability 
of getting the result of the measurement corresponding 
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to the projector |wn)(&ii| provided the state |/f x ) was 
sent. 

Using the probabilities in Eq. (|17f) . we can compute the 
mutual information between Alice and Eve as a function 
of 8. The optimal measurement for Eve is then given by 
the 6 that maximizes the mutual information between 
them. 

Suppose now that Eve receives ancillas from the o~ x 
basis. If Alice measured bit '0' (fc = 0, probability \) : 
Eve will obtain the state 

Q [ k % = (« + /3i)l/ooX/o a: ol + (« + /32)|/fo)(/foUl8) 

and if Alice measured '1' (fc = 1, probability i), Eve will 
obtain the state 

ffjSi = (« + /3 1 )|^ 1 >(^ 1 | + (a + /3 2 )|/f 1 )(/f 1 |.(19) 

The structure of the (normalized) ancillas is given by 
Eq. ©: 

(/fol/fi) = = Ai 
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Now, the total state describing Eve's ancillas is given 



by 



Q (x) = ^^l/ooX/ool + ^^l/oiX/oil 
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which has the following eigenkets 

\go) = ^(l/oo) + l/oi» 

\m) = ^(l/fo) + l/n» 

\92) = ^ («+ (1/5,) - \fSt)) + V (|/fo) - l/fi))) 

b) - ^ («-(!/&> + 17 (I/a) -l/u))) 
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where 
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The normalization constants A4 (fc = 0, 1, 2, 3) read 



V = 2 7 
lization 
•A/q = ^(l + Ao) 



(23) 



If we adopt {\go), \gx), \g 2 ), I53)} as an orthonormal ba- 
sis, the optimal measurement for Eve can then be ex- 
pressed as {\uj )(u \, \uj 2 )(uj 2 \, \uj 3 )(u 3 \}, where 



M = ^(l + Ai) 

■A/2 = + 4 T 2 -VTfo- Pi) 2 + 47 2 )) 

■A/3 = 4^ (ft/d + 4 7 2 (ft + 7(/3 2 - ft) 2 + 472)"). 

(24) 
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and in which a, 6, c, d are real numbers. These parameters 
are also related by 



(26) 



so that the operators decompose the identity. 

As before, we can compute the mutual information be- 
tween Alice and Eve I (A; E) for this basis and maximize 
it over the two independent variables a and c to obtain 
the maximum information that Eve can obtain about Al- 
ice's measurements. 

It should be mentioned here that the optimality of 
the above POVMs for the three bases was deduced and 
confirmed numerically using the algorithms presented in 
Refs. [H. 

Table [I] summarizes the results of the computations for 
various values of g and V. We fixed the ratio ^ = 1.1 
(the value reported in Ref. We see that for certain 
values of g and V (the first row of the table), for which 
the state is still entangled, the CK yield (denoted as A) 
is negative in all the measurement bases. For such states, 
according to the CK theorem, one cannot extract secure 
bits by means of one-way communication (because the 
CK yield is zero). More interesting are cases where the 
CK yield is negative in one measurement basis and pos- 
itive in another. In such cases, Alice and Bob reject the 
data obtained by measurements in the basis with neg- 
ative yield and process only the data from the basis for 
which the CK yield is positive. The total CK yield is then 
the equally-weighted average of only the positive yields 
from the three measurement bases. In the case where all 
the CK yields are positive, Alice and Bob use the data 
from all the bases. 
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§A a + iA x = 0.0076 
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|A Z + ±A y + iA x =0.1014 



TABLE I: Table of yields in the three bases for ■£ = 1.1, and different values of g and V. Due to the asymmetric nature of the 
state in the a z and a x /<j y bases, the yield is different for those bases. The yield is the same in a x and a y . Crosses mean that 
the data from this basis is not used for the key generation. 
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FIG. 1: Three-dimensional plot of the CK yield for perfect beamsplitters R — T (left), and the corresponding contour plot 
(right). The threshold for security is given by the contour for which the CK yield is zero. For g = 0, security is guaranteed as 
long as V is greater than zero, although fewer secure bits can be distilled for smaller V . 



In Fig. ^ we show the overall CK yield plotted against 
g and V in the case of perfect beamsplitters (R — T). In 
this case the state produced by the source is a mixture 
of Bell states. The security thresholds for such states 
have been analyzed in Ref. [j] . We observe that the pro- 
tocol is always secure against incoherent attacks as long 
as g — and V > 0, although fewer secure bits can be 
distilled for smaller V. If V is zero the state becomes 
separable and, of course, one cannot extract any secure 
bits. More detailed analysis reveals that these states (for 
which R = T, g = and V > 0) have the interesting 
property that the mutual information between Alice and 
Eve is always zero when Alice performs measurements in 
a x or <j y basis. This is due to the fact that Eve's ancillas 
corresponding to different outcomes of Alice's measure- 
ments in the a x and a y bases are the same, which means 
that they do not carry any information whatsoever about 
Alice's and Bob's correlations. Therefore, if Alice and 
Bob agree on using only the data from the a x and a v 
measurements (this reduces the efficiency), the protocol 
becomes secure against all possible attacks by Eve (un- 
conditional security). In realistic situations however, the 



value of g can be small but not exactly zero (for example, 
the value of g reported in @ was 0.02). In this case, the 
protocol is secure over a smaller range of V . Even then, 
we conjecture that the information that Eve can extract 
from her ancillas in the a x or a y basis is negligible, and 
the protocol remains pretty robust against all possible 
attacks by her in those bases. 



NOISY CHANNEL 

So far, we have excluded the effects of noise in the 
channel so that Alice and Bob expect to receive the state 
'as-is' from the source. In reality however, this is not the 
case: Alice and Bob can expect their quantum channel to 
be affected by interaction with the environment. We next 
consider what happens when there is symmetric white 
noise present in the channel, i.e. the state that Alice and 
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FIG. 2: Overall CK yield for ^ = 1.1 and g = 0.02 and different amounts of noise in the channel F. For a noiseless channel 
(F = 0), when V < 0.39, one can no longer extract secure bits by means of one-way communication because the CK yield is 
zero. As the amount of noise increases, the CK yield drops until for F > 0.42, where we will not be able to distill any secure 
bits at all (because the CK yield is for all V). 



Bob expect to receive is of the form: 
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where we have a proportion F (0 < F < 1) of unbi- 
ased noise admixed to the original state from the source. 



Analysis shows that the optimal POVM for Eve is of the 
same form as that presented earlier. 



As before, we can obtain the condition for security and 
the CK yield for various proportions of noise and this is 
shown in Fig.|3 for fixed values of ^ = 1.1 and g = 0.02 
(values reported in Ref. 0,0)- We can distill less secure 
bits as the amount of noise increases. 
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CONCLUSION 

We have analyzed the security of the tomographic 
QKD protocol using a source of entangled photons pro- 
duced in the experimental scheme proposed by Fattal et. 
al 0| against the most general incoherent attacks. 

Using the analysis presented in this paper we can give 
the number of secure bits that can be distilled by means 
of one-way communication between Alice and Bob as 
a function of the experimentally accessible parameters 
R, T, g and V, and for different degrees of unbiased noise 
in the channel F. 
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